High severity · published Mar 9, 2016
CVE-2016-0099
Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability
RansomwareIn wildKEV
7.8
CVSS
37%
EPSS
Yes
On KEV
Description
The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 does not properly process request handles, which allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)37.0% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 3, 2022
Federal remediation dueMar 24, 2022
Ransomware campaign useKnown
Affected products
Which versions
WI
Windows · Microsoft
All versions, or not specified · source: KEV
W1
Windows 10 1507 · Microsoft
All versions, or not specified · source: NVD
W1
Windows 10 1511 · Microsoft
All versions, or not specified · source: NVD
W7
Windows 7 · Microsoft
All versions, or not specified · source: NVD
W8
Windows 8.1 · Microsoft
All versions, or not specified · source: NVD
WS
Windows Server 2008 · Microsoft
r2 · source: NVD
WS
Windows Server 2012 · Microsoft
r2 · source: NVD
WV
Windows Vista · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-0099
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-0099
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
exploit
https://www.exploit-db.com/exploits/40107/
exploit
https://www.exploit-db.com/exploits/39719/
exploit
https://www.exploit-db.com/exploits/39809/
vdb-entry
http://www.securityfocus.com/bid/84034
vdb-entry
http://www.securitytracker.com/id/1035210
vendor-advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-032
More from Windows
10.0
CVE-2020-1350
Microsoft Windows DNS Server Remote Code Execution Vulnerability
9.8
CVE-2025-59287
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
9.8
CVE-2019-0708
Microsoft Remote Desktop Services Remote Code Execution Vulnerability
9.8
CVE-2017-8543
Microsoft Windows Search Remote Code Execution Vulnerability
9.8
CVE-2008-4250
Microsoft Windows Buffer Overflow Vulnerability